Even worse, granting permissions to applications
may implicitly compromise private data. By granting access to other applications the user builds some kind of trust
chain which may not all data items this chain can process.
Thus, the user grants mostly unknowingly implicit access rights to applications. An access control system which
is simply based on assigning capabilities to processes will
not solve this problem. Systems based on data usage decisions are required and thus systems which can provide data
security policies.